Scribd Logo
Upload

Welcome to Scribd!

  • Detect and Block Port Scanners

    Uploaded by

    Bedest Cakep
    2K views2 pages
    The document describes firewall rules to log and block potential port scanners and invalid connection attempts. It also defines rules to accept common services like web, SSH, and VPN from trusted networks and prioritize traffic from users.

    Original Description:

    Original Title

    Block Scanner Mikrotik

    Copyright

    © Attribution Non-Commercial (BY-NC)

    Available Formats

    TXT, PDF, TXT or read online from Scribd

    Did you find this document useful?

    Is this content inappropriate?

    Report this Document
    The document describes firewall rules to log and block potential port scanners and invalid connection attempts. It also defines rules to accept common services like web, SSH, and VPN from trusted networks and prioritize traffic from users.

    Copyright:

    Attribution Non-Commercial (BY-NC)
    Download as TXT, PDF, TXT or read online from Scribd
    Flag for inappropriate content
    2K views2 pages

    Detect and Block Port Scanners

    Uploaded by

    Bedest Cakep
    The document describes firewall rules to log and block potential port scanners and invalid connection attempts. It also defines rules to accept common services like web, SSH, and VPN from trusted networks and prioritize traffic from users.

    Copyright:

    Attribution Non-Commercial (BY-NC)
    Download as TXT, PDF, TXT or read online from Scribd
    Flag for inappropriate content
    of 2

    /ip firewall filter add chain=input protocol=tcp psd=21,3s,3,1 action=add-src-to-address-list addre ss-list="port scanners" address-list-timeout=2w comment="Port scanners to list

    " disabled=no Chain ini dipakai untuk mendaftar ip ke black-list address list Chain selanjutnya untuk mendeteksi apakah ada indikasi aktifitas port scanner: add chain=input protocol=tcp tcp-flags=fin,!syn,!rst,!psh,!ack,!urg action=add-src-to-address-list address-list="port scanners" address-list-timeout=2w comment="NMAP FIN Stealth scan" add chain=input protocol=tcp tcp-flags=fin,syn action=add-src-to-address-list address-list="port scanners" address-list-timeout=2w comment="SYN/FIN scan" add chain=input protocol=tcp tcp-flags=syn,rst action=add-src-to-address-list address-list="port scanners" address-list-timeout=2w comment="SYN/RST scan" add chain=input protocol=tcp tcp-flags=fin,psh,urg,!syn,!rst,!ack action=add-src-to-address-list address-list="port scanners" address-list-timeout=2w comment="FIN/PSH/URG scan" add chain=input protocol=tcp tcp-flags=fin,syn,rst,psh,ack,urg action=add-src-to-address-list address-list="port scanners" address-list-timeout=2w comment="ALL/ALL scan" add chain=input protocol=tcp tcp-flags=!fin,!syn,!rst,!psh,!ack,!urg action=add-src-to-address-list address-list="port scanners" address-list-timeout=2w comment="NMAP NULL scan" add chain=input src-address-list="port scanners" action=drop comment="dropping p ort scanners" disabled=no

    /ip firewall filter add chain=input connection-state=invalid action=drop comment = Drop_invalid_connections /ip firewall filter add chain=input protocol=udp action=accept comment= UDP /ip firewall filter add chain=input protocol=icmp limit=50/5s,2 action=accept c omment= Allow_limited_pings /ip firewall filter add chain=input protocol=icmp action=drop comment= Drop_exces s_pings /ip firewall filter add chain=input protocol=tcp dst-port=21 src-address-list=o urnetwork action=accept comment= FTP /ip firewall filter add chain=input protocol=tcp dst-port=22 src-address-list=o urnetwork action=accept comment= SSH_for_secure_shell /ip firewall filter add chain=input protocol=tcp dst-port=23 src-address-list=o urnetwork action=accept comment= Telnet /ip firewall filter add chain=input protocol=tcp dst-port=80 src-address-list=o urnetwork action=accept comment= Web /ip firewall filter add chain=input protocol=tcp dst-port=8291 src-address-list =ournetwork action=accept comment= winbox /ip firewall filter add chain=input protocol=tcp dst-port=1723 action=accept co mment= pptp-server /ip firewall filter add chain=input action=log log-prefix="DROP INPUT" comment= L og_everything_else /ip firewall filter add chain=input protocol=tcp dst-port=23 src-address-list=o urnetwork action=accept comment= Telnet

    /ip firewall filter add chain=input protocol=tcp dst-port=80 src-address-list=o urnetwork action=accept comment= Web1 /ip firewall mangle add chain=prerouting protocol=icmp action=mark-connection n ew-connection-mark=icmp-con passthrough=yes comment= bikin_cepat_ping_dan_dns /ip firewall filter add chain=input protocol=tcp dst-port=1723 action=accept co mment= pptp-server /ip firewall filter add chain=input action=log log-prefix="DROP INPUT" comment= L ogeverythingelse /ip firewall filter add chain=input protocol=tcp dst-port=8291 src-address-list =ournetwork action=accept comment= winbox1

    /ip firewall mangle add chain=forward src-address=192.168.2.0/24 action=mark-con nection new-connection-mark=users-con /ip firewall mangle add connection-mark=users-con action=mark-packet new-packet -mark=users chain=forward /queue type add name=pcq-download kind=pcq pcq-classifier=dst-address /queue type add name=pcq-upload kind=pcq pcq-classifier=src-address /queue tree add parent=Local-wifi queue=pcq-download packet-mark=users /queue tree add parent=firstmedia1 queue=pcq-upload packet-mark=users /queue tree add parent=firstmedia1 queue=pcq-upload packet-mark=users

    You might also like